Re: [PATCH v2 2/2] setup: allow Git.pm to do unsafe repo checking
On Sat, Oct 22, 2022 at 05:16:38PM -0400, Jeff King wrote:
Show 18 quoted lines
> Again, I'm not too familiar with Git.pm, but it seems it ought to be
> asking Git: are we in a valid Git repo, and if so where is it? Something
> like:
>
> my $git_dir = `git rev-parse --absolute-git-dir`;
> $? and die "nope, not in a git repo";
>
> # later, when we run git commands, we do specify this; the script may
> # have chdir()'d in the meantime, and we want to make sure we are
> # referring to the same repo via the object.
> local $ENV{GIT_DIR} = abs_path($git_dir);
> ...run some git command...
>
> Looking at the code, we even seem to do that first part! But if it
> returns an error, then we go on to check for a bare repository
> ourselves by looking for refs/, objects/, etc. Which is just...weird.
>
> It feels like this try/catch should just go away:It's a little more complicated than that, because presumably people rely on the error handling for a missing repo to not be noisy. So here's a polished version of what I showed, along with the tests we were discussing earlier.
I prepared it on top of your fix in the mm/git-pm-try-catch-syntax-fix branch. That's not strictly necessary, since my patch deletes the line you fixed. :) But I think it's nicer to use your fix as the starting point, since it means the test runs but produces the wrong behavior, rather than barfing with a syntax error.
-- >8 --
Subject: [PATCH] Git.pm: trust rev-parse to find bare repositories
When initializing a repository object, we run "git rev-parse --git-dir" to let the C version of Git find the correct directory. But curiously, if this fails we don't automatically say "not a git repository". Instead, we do our own pure-perl check to see if we're in a bare repository.
This makes little sense, as rev-parse will report both bare and non-bare directories. This logic comes from d5c7721d58 (Git.pm: Add support for subdirectories inside of working copies, 2006-06-24), but I don't see any reason given why we can't just rely on rev-parse. Worse, because we treat any non-error response from rev-parse as a non-bare repository, we'll erroneously set the object's WorkingCopy, even in a bare repository.
But it gets worse. Since 8959555cee (setup_git_directory(): add an owner check for the top-level directory, 2022-03-02), it's actively wrong (and dangerous). The perl code doesn't implement the same ownership checks. And worse, after "finding" the bare repository, it sets GIT_DIR in the environment, which tells any subsequent Git commands that we've confirmed the directory is OK, and to trust us. I.e., it re-opens the vulnerability plugged by 8959555cee when using Git.pm's repository discovery code.
We can fix this by just relying on rev-parse to tell us when we're not in a repository, which fixes the vulnerability. Furthermore, we'll ask its --is-bare-repository function to tell us if we're bare or not, and rely on that.
Signed-off-by: Jeff King <peff@peff.net>
---
I didn't dig into the "oops, we set WorkingCopy" thing beyond manually
verifying that it happens. It doesn't look like its really used beyond
the wc_path() method, so it's not like it would have been breaking git
sub-commands, etc. I guess we could add a test that wc_path() returns
undef in a bare repository, though.
perl/Git.pm | 36 ++++++++++++++++--------------------
t/t9700-perl-git.sh | 4 ++++
t/t9700/test.pl | 12 ++++++++++++
3 files changed, 32 insertions(+), 20 deletions(-)
Show changes to 3 files +32 −20
perl/Git.pm, t/t9700-perl-git.sh, t/t9700/test.pl
diff --git a/perl/Git.pm b/perl/Git.pm
index cf15ead664..117765dc73 100644
--- a/perl/Git.pm
+++ b/perl/Git.pm
@@ -177,16 +177,27 @@ sub repository {
-d $opts{Directory} or throw Error::Simple("Directory not found: $opts{Directory} $!");
my $search = Git->repository(WorkingCopy => $opts{Directory});
- my $dir;
+
+ # This rev-parse will throw an exception if we're not in a
+ # repository, which is what we want, but it's kind of noisy.
+ # Ideally we'd capture stderr and relay it, but doing so is
+ # awkward without depending on it fitting in a pipe buffer. So
+ # we just reproduce a plausible error message ourselves.
+ my $out;
try {
- $dir = $search->command_oneline(['rev-parse', '--git-dir'],
- STDERR => 0);
+ # Note that "--is-bare-repository" must come first, as
+ # --git-dir output could contain newlines.
+ $out = $search->command([qw(rev-parse --is-bare-repository --git-dir)],
+ STDERR => 0);
} catch Git::Error::Command with {
- $dir = undef;
+ throw Error::Simple("fatal: not a git repository: $opts{Directory}");
};
+ chomp $out;
+ my ($bare, $dir) = split /\n/, $out, 2;
+
require Cwd;
- if ($dir) {
+ if ($bare ne 'true') {
require File::Spec;
File::Spec->file_name_is_absolute($dir) or $dir = $opts{Directory} . '/' . $dir;
$opts{Repository} = Cwd::abs_path($dir);
@@ -204,21 +215,6 @@ sub repository {
$opts{WorkingSubdir} = $prefix;
} else {
- # A bare repository? Let's see...
- $dir = $opts{Directory};
-
- unless (-d "$dir/refs" and -d "$dir/objects" and -e "$dir/HEAD") {
- # Mimic git-rev-parse --git-dir error message:
- throw Error::Simple("fatal: Not a git repository: $dir");
- }
- my $search = Git->repository(Repository => $dir);
- try {
- $search->command('symbolic-ref', 'HEAD');
- } catch Git::Error::Command with {
- # Mimic git-rev-parse --git-dir error message:
- throw Error::Simple("fatal: Not a git repository: $dir");
- };
-
$opts{Repository} = Cwd::abs_path($dir);
}
diff --git a/t/t9700-perl-git.sh b/t/t9700-perl-git.sh
index 4aa5d90d32..b105d6d9d5 100755
--- a/t/t9700-perl-git.sh
+++ b/t/t9700-perl-git.sh
@@ -45,6 +45,10 @@ test_expect_success \
git config --add test.pathmulti bar
'
+test_expect_success 'set up bare repository' '
+ git init --bare bare.git
+'
+
test_expect_success 'use t9700/test.pl to test Git.pm' '
"$PERL_PATH" "$TEST_DIRECTORY"/t9700/test.pl 2>stderr &&
test_must_be_empty stderr
diff --git a/t/t9700/test.pl b/t/t9700/test.pl
index e046f7db76..6d753708d2 100755
--- a/t/t9700/test.pl
+++ b/t/t9700/test.pl
@@ -30,6 +30,18 @@ sub adjust_dirsep {
# set up
our $abs_repo_dir = cwd();
ok(our $r = Git->repository(Directory => "."), "open repository");
+{
+ local $ENV{GIT_TEST_ASSUME_DIFFERENT_OWNER} = 1;
+ my $failed;
+
+ $failed = eval { Git->repository(Directory => $abs_repo_dir) };
+ ok(!$failed, "reject unsafe non-bare repository");
+ like($@, qr/not a git repository/i, "unsafe error message");
+
+ $failed = eval { Git->repository(Directory => "$abs_repo_dir/bare.git") };
+ ok(!$failed, "reject unsafe bare repository");
+ like($@, qr/not a git repository/i, "unsafe error message");
+}
# config
is($r->config("test.string"), "value", "config scalar: string");
--
2.38.1.497.g093b959162
Michael McClimon
